# I moderatori possono creare/modificare categorie in modo che perdano l'accesso

**URL:** https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978
**Category:** Bug
**Tags:** moderation
**Created:** [10 Dicembre 2025, 8:36pm UTC](https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978 "2025-12-10T20:36:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Steradiant](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/steradiant/32/360541_2.png) [@Steradiant](https://meta.discourse.org/u/Steradiant)
#### Post date: [10 Dicembre 2025, 8:36pm UTC](https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978/1 "2025-12-10T20:36:10Z")

</div>

C’è un’impostazione che consente ai moderatori di gestire le categorie.  
Se questa è attiva, i moderatori possono modificare le impostazioni di sicurezza di una categoria in modo da non avere più accesso, il che è molto probabilmente accidentale.  
Gli amministratori possono, ovviamente, risolvere questa situazione.

Suggerisco di rimediare a questo comportamento vietando ai moderatori di modificare una categoria in modo tale da perdere l’accesso.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [11 Dicembre 2025, 10:15pm UTC](https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978/2 "2025-12-11T22:15:07Z")

</div>

D’accordo, come minimo un qualche tipo di avviso che ciò accadrà con una conferma.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [12 Dicembre 2025, 4:24pm UTC](https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978/3 "2025-12-12T16:24:37Z")

</div>

Grazie per la segnalazione @Steradiant 👍

Ora mostreremo una finestra di dialogo di conferma se l’utente sta per perdere l’accesso a una categoria modificandone le autorizzazioni

> <https://github.com/discourse/discourse/pull/36663>
>
> When moderators with \`moderators\_manage\_categories\` enabled change category perm…issions, they could accidentally remove their own access, requiring admin intervention to fix.
> 
> This adds a client-side confirmation dialog that warns moderators before saving permission changes that would lock them out. If confirmed, the changes are saved and the user is redirected to the home page.
> 
> Changes:
> \- Add \`\_wouldLoseAccess()\` check in edit-category controller that compares new permissions against the user's group memberships
> \- Show confirmation dialog via \`dialog.yesNoConfirm()\` before saving
> \- Redirect to home page after confirmed save (since user can no longer access the category edit page)
> \- Fix \`onSelectGroup\` to properly set \`group\_id\` for custom groups by looking up from \`site.groups\` (was only working for auto groups)
> 
> Here's how the confirm dialog looks like
> 
> \<img width="1606" height="1043" alt="CleanShot 2025-12-12 at 17 12 55" src="https://github.com/user-attachments/assets/86e255dc-fa5c-4fde-8c86-3d3b0e03ce89" /\>
> 
> 
> Ref - https://meta.discourse.org/t/390978

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [18 Dicembre 2025, 10:04am UTC](https://meta.discourse.org/t/moderators-can-create-change-categories-such-that-they-lose-access/390978/5 "2025-12-18T10:04:26Z")

</div>